Windows Update / SvcHost.exe 100% Cpu in task manager

Xircal wrote:

 

"Generally speaking, this will fix the problem and after installing the IE8 cumulative update, you should be able to download from the Windows Update site normally. You can get that from here:

http://www.microsoft.com/en-us/download/details.aspx?id=41074"

 

Clearly the BITS issue is only one part of the problem and there is another second aspect to the CPU spiking issue involving negotiation with the browser IE8 or any other XP associated IE browser version which is encountering what amounts to hostile script from the Windows Update site.  To preinstall the latest cumulative security update acts as a one month "special XP associated browser passport" lease or however much is the remaining time until the next cumulative security update, for a provisionally allowed communication with that Windows Update server.  IMO  it is Microsoft Corporation that is doing that specification of access permissions that is licensing month by month an exception, a special permission dispensation to allow even the lowly undesirable "crippled" versions of IE to connect to ANY Microsoft Corporation web server. 

Hi Keith,

Well, as far as I'm concerned, this issue only concerns me as it relates to accessing the Windows Update site. I use Firefox for everything else.

I got the same problem on two PCs though and one of them is just a backup machine (I don't like laptops). The backup never gets used for anything and the only reason I keep it is in case the machine I'm using now goes pear-shaped. So I find it very strange that this problem with BITS manifested itself on that PC as well.

Something, I don't know what was introduced in the October Patch Tuesday update, or at least it looks that way.

Xircal wrote:

"Generally speaking, this will fix the problem and after installing the IE8 cumulative update, you should be able to download from the Windows Update site normally. You can get that from here:

http://www.microsoft.com/en-us/download/details.aspx?id=41074"

Clearly the BITS issue is only one part of the problem and there is another second aspect to the CPU spiking issue involving negotiation with the browser IE8 or any other XP associated IE browser version which is encountering what amounts to hostile script from the Windows Update site.  To preinstall the latest cumulative security update acts as a one month "special XP associated browser passport" lease or however much is the remaining time until the next cumulative security update, for a provisionally allowed communication with that Windows Update server.  IMO  it is Microsoft Corporation that is doing that specification of access permissions that is licensing month by month an exception, a special permission dispensation to allow even the lowly undesirable "crippled" versions of IE to connect to ANY Microsoft Corporation web server. 

If you want to pet the porcupine that is Windows Update then Microsoft will lend you a new pair of leather gloves needed each month on Black Tuesday until April 2014.  Then the supply of special gloves runs out.

Isn't that just soooooo clever?

Thank you for taking the time to read my issue and offer your advice for this WindowsXP SP3 issue.

 

Realizing more information is better than less - I should have advised that I tried this in my original post. I should have also noted that my computer is NOT currently/stuck using 100% CPU as I know that it is the Automatic updates module that is the culprit. Through my analysis and troubleshooting to identify the contributing factors to this troublesome event....I DID DISABLE or turn off Automatic updates in the Automatic updates control. I also experimented with setting 'download but let me install'; 'notify me IF updates are available'. Any setting to get updates activates svcehost to use 100% CPU.  I chose to turn off Automatic updates as it was the ONLY WAY to STOP 100% use of the CPU. After all - 100% use of a CPU is akin to getting into your car and pressing and holding the accelerator to the floorboards - eventually (maybe real soon) you will destroy your engine.

---

I just took  long time to say I already did that - Xircal. No matter what I tried - any attempt to get my computer updated - again: 'notify me if', 'download but let me decide' or  ' automatically download' - - within seconds svcehost shoots like a rocket to 100% CPU usage.

 

The routine you wrote above the action words you used: *"****If it does, do the following" suggests to me to use the routineonly IF** with Auto updates OFF with the CPU remains at 100% to apply the routine.* 

 

 

 

---

Hi Joseph,

I'll try and explain it to you so that you get a better understanding of the processes involved.

With Automatic Updates enabled, even if it's only to notify you when there are some available, the operating system attempts to make a connection to the Windows Update site on the second Tuesday of every month using a service called the Background Intelligent Transfer Service a.k.a. BITS to download the updates. The process used to perform the task is svchost.exe. "Svc" is an abbreviation of "Server". So in effect, the full name of the process is Server Host which is also an exe file.

Windows uses a dynamic link library file to perform that task called qmgr.dll. If you right click that file and go to "Properties" and then click the "Version" tab, you'll see that it's called "Background Intelligent Transfer Service".

However, dynamic link library files have to be registered in the system in order for an executable to be able to call them.

If for some reason the dll file which needs to be called has become corrupted, it will be unregistered. Windows however is just a dumb operating system which tries to perform a command regardless of what has happened to a file needed to perform the operation.

So svchost.exe is trying to enact the command to run qmgr.dll which is no longer registered and cannot be called. This leads to a the CPU working overtime to complete the instruction. Eventually, it will consume 100% CPU cycles and the system will lockup.

To rectify the problem, Automatic Updates needs to be disabled so that svchost.exe will no longer run.

However, the user is still faced with the need to install critical security patches released to address vulnerabilities discovered in the operating system.

With Automatic Updates disabled, the usual course of action is to load the Windows Update Site manually.

However, this results in a Remote Procedure Call to BITS. Because BITS (qmgr.dll) has become unregistered and therefore cannot be started, the animation on the Windows Update site continues indefinitely.

To rectify the problem, BITS needs to be registered using regsvr32. "Regsvr32" is an abbreviation of Register Server and its function is to register dynamic link library files (.dll). 

So to register BITS, open the Run command (hit Windows key + R to launch the Run field) and then copy/paste the following to register BITS as a service: regsvr32 qmgr.dll

It's also necessary to register the BITS proxy using the same command: regsvr32 qmgrprxy.dll

Once BITS has been registered, the Windows needs to be told where to find the files. This is done by running the following command:

%windir%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %windir%\inf\qmgr.inf

The PC needs to be rebooted after running this command.

qmgr.inf though needs qmgr.dll. Since it doesn't know where to find it, it assumes it must be on the Windows installation CD. So you get a dialog box to tell you to insert that.

However, qmgr.dll will be present in the i386 folder, so all the user needs to do is to change the path to C:\WINDOWS\ServicePackFiles\i386

Once those commands have been performed, it's advisable to check the Services menu - run services.msc from the Run command - in order to verify that BITS is present.

If it is, then it's also a good idea to make sure it works. Do do that, double click it in the Services menu and then click the Start button on the General tab.

What can go wrong here is that the registration process has changed the registry path. If that happens, you get "Error 2: cannot find the file specified".

To tell Windows where BITS is located, this command needs to be run:

Reg add HKLM\SYSTEM\CurrentControlSet\Services\BITS\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %windir%\System32\qmgr.dll

Since this is a registry change, the system needs to be rebooted again.

Generally speaking, this will fix the problem and after installing the IE8 cumulative update, you should be able to download from the Windows Update site normally. You can get that from here:

http://www.microsoft.com/en-us/download/details.aspx?id=41074

If it still fails, it's because an invalid entry has been made to the FilesNotToBackup registry key. To correct that, copy/paste this command into the Run field and click OK:

Reg add HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup

Once again, because you're making a registry change, you need to reboot.

If you have any questions, fire away.

When the updates began streaming for me last month it was the same, like the floodgates were opened and the files were streaming at a blur of speed on parallel paths through both the automatic updates silent channel where the tray icon was showing updates ready to install, and also got the more than 125 updates through the open browser at Microsoft Update.  It ran amazingly fast when the files began streaming.  I remember chuckling for thinking at the time there wasn't much sharing of bandwidth for the few people who were getting any downloads from Windows Update. 

30% of the computers on earth are running Windows XP and it is embedded in some equipment that can't be just "upgraded" in an unplanned sudden OS transition......so it is a huge problem.  I have 3 new desktops sitting in crates nearby with Windows 7 and 2 more machines still on XP to be upgraded, so this issue is more psychological aggravation than "mission critical" for me.  Windows XP at the IE7 level was always rock stable and desktops would be left on 24/7 sometimes 2 months without a maintenance cycle and a reboot.  Behind a firewall zero viruses or exploits in 10 years, you can't do better than 100% rock solid secure. The only issues I ever had were hardware issues like drive failures and power supplies or a memory stick or motherboard or video card, probably due to thunderstorm and lightning caused line surges that got through the surge protectors.  XP SP3 has been every bit as much of a truly outstanding operating system as has IE8 been a real stinker as a crippled bloated toolbar "browser" too soon incompatible with most websites.  The idea of a web browser is ability to view and interact with most websites. So what is the real purpose for IE8 ?  Did IE8 ever really do that well except for a short time?  What ever was the true purpose for IE8 ?

Firefox exposes what Microsoft did to XP crippling XP functionality via IE8.  Many websites will not even function when attempted to be viewed using IE8 so for that to be the case then de facto support for XP was already effectively ended with IE8.  Microsoft will not openly declare that support for XP has already ended, but will gradually make it impossible to use XP so that the clingers on gradually figure it out themselves that XP has been obsoleted and how it was done was through the browser IE8.  Any supported Microsoft OS will or should always have a supported Internet Explorer to go with it and should have a reliable e-mail client also, not just a Web Mail, but an actual standalone e-mail client with local storage like the old Outlook Express or Windows Live Mail.  If not, then MS should include Office Outlook with the OS.